/**
 * Workspace write guard + catastrophic-command guard.
 *
 * Enforced in code (not just prompt): write/edit targets outside the
 * allow-listed roots are blocked with an instructive tool error unless the
 * user opted in via the `allowOutsideWorkspaceWrites` setting. The bash tool
 * additionally refuses a tiny set of unambiguous filesystem disasters
 * (recursive removal of /, ~, $HOME, the workspace root or anything that
 * contains them, a bare drive root, and mirror force-pushes) until the user
 * explicitly confirms.
 *
 * Deliberately narrow: ordinary `rm -rf node_modules`, `git reset --hard`,
 * etc. stay instructional (ask-first at the prompt level), exactly as today.
 */
export interface WriteGuardSettings {
    allowOutsideWorkspaceWrites?: boolean;
    /** Extra workspace roots added at runtime via `/add-dir`. */
    additionalRoots?: string[];
}
export interface WriteGuardResult {
    allowed: boolean;
    reason?: string;
}
/**
 * Decide whether a resolved write/edit target path is allowed.
 * Allowed by default: under `cwd`, under the OS temp dir, and under the
 * agent's own state dir (~/.gg) — sessions/plans/settings must keep working.
 *
 * Both sides are compared AFTER symlink resolution (see {@link realResolve}):
 * the target, so a link inside the workspace cannot point out of it, and the
 * roots, because the OS aliases its own (macOS `/tmp` → `/private/tmp`, and
 * `/var/folders` under it) and comparing a resolved target against an
 * unresolved root would deny every legitimate temp-dir write.
 */
export declare function resolveWriteGuard(cwd: string, resolvedPath: string, settings?: WriteGuardSettings): WriteGuardResult;
/**
 * Match only the unambiguous disasters, wherever they sit in the command —
 * after `;`/`&&`/`||`/pipes, inside `if`/`for`/`while`/`{ }`/`( )`, behind
 * wrappers (`sudo`, `env`, `timeout`, `nohup`, `nice`, `exec`, `time`,
 * `xargs`, …), inside `bash -c`/`eval`/`pwsh -c`, and after a `cd`:
 * - recursive `rm` (any flag spelling, any path form of the command) of a
 *   filesystem root, `~`/`$HOME`, the workspace root, a directory containing
 *   either, or the whole contents of one (`/*`, `cd ~ && rm -rf *`)
 * - the same through PowerShell `Remove-Item -Recurse` and cmd `rd /s`
 * - `find` deleting from root/home, or from the workspace with no filter
 * - `git push --force --mirror` (mirror force-push rewrites every ref)
 *
 * Returns an error string telling the model to get explicit user confirmation,
 * or null when the command is not catastrophic. Pure: nothing is executed.
 *
 * Backslashes are read both ways: as bash escapes, and literally, as cmd.exe
 * and PowerShell (the Windows fallbacks) read them, where `C:\Users\me` is a
 * path rather than `C:Usersme`. Either reading hitting a protected directory
 * blocks the command.
 */
export declare function isCatastrophicCommand(command: string, cwd: string): string | null;